Remove connection string from web.config when Connection string in IIS

Question

I am trying to hide the connection string in my asp.net application. In IIS7 I added the connection string and need to know what I change in my asp.net web application web.config file.

For example, In IIS7 I created a database connection string named SSConection. I specified the server and the database and also provided user name and password.

This connection string information is also in my web.config and linq to sql entities. Do I just remove the connection string or do I reference it in someway?

Thanks

Answer 1

You could set IIS to use an encrypted web.config file - or at least encrypt the section containing your connection settings.

http://msdn.microsoft.com/en-us/library/zhhddkxy(v=vs.100).aspx See here

Answer 2

I've used this before:

http://msdn.microsoft.com/en-us/library/89211k9b%28v=vs.80%29.aspx

works like a charm.